CVE-2021-35030: Zyxel GS1900-10hp Firmware

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and could allow an authenticated, local user to perform a cross-site scripting (XSS) attack via a crafted LLDP packet.

Affected products

• Zyxel GS1900-10hp Firmware: before 2.70 (fixed in 2.70)
• Zyxel GS1900-16 Firmware: before 2.70 (fixed in 2.70)
• Zyxel GS1900-24 Firmware: before 2.70 (fixed in 2.70)
• Zyxel GS1900-24e Firmware: before 2.70 (fixed in 2.70)
• Zyxel GS1900-24ep Firmware: before 2.70 (fixed in 2.70)
• Zyxel GS1900-24hp Firmware: before 2.70 (fixed in 2.70)
• Zyxel GS1900-24hpv2 Firmware: before 2.70 (fixed in 2.70)
• Zyxel GS1900-48 Firmware: before 2.70 (fixed in 2.70)
• Zyxel GS1900-48hp Firmware: before 2.70 (fixed in 2.70)
• Zyxel GS1900-48hpv2 Firmware: before 2.70 (fixed in 2.70)
• Zyxel GS1900-8 Firmware: before 2.70 (fixed in 2.70)
• Zyxel GS1900-8hp Firmware: before 2.70 (fixed in 2.70)

Published 2021-07-26. Last modified 2026-06-17.